Skip to main content
Version: v4.22

partitions

Retrieves metadata about events stored at a node.

Synopsis

partitions [<expr>]

Description

The partitions operator shows a summary of candidate partitions at a node.

<expr>

Show only partitions which would be considered for pipelines of the form export | where <expr> instead of returning all data.

Schemas

Tenzir emits partition information with the following schema:

tenzir.partition

Contains detailed information about a partition.

FieldTypeDescription
uuidstringThe unique ID of the partition in the UUIDv4 format.
memusageuint64The memory usage of the partition in bytes.
diskusageuint64The disk usage of the partition in bytes.
eventsuint64The number of events contained in the partition.
min_import_timetimeThe time at which the first event of the partition arrived at the import operator.
max_import_timetimeThe time at which the last event of the partition arrived at the import operator.
versionuint64The version number of the internal partition storage format.
schemastringThe schema name of the events contained in the partition.
schema_idstringA unique identifier for the physical layout of the partition.
storerecordResource information about the partition's store.
indexesrecordResource information about the partition's indexes.
sketchesrecordResource information about the partition's sketches.

The records store, indexes, and sketches have the following schema:

FieldTypeDescription
urlstringThe URL of the resource.
sizeuint64The size of the resource.

Examples

Get an overview of the memory and disk requirements for all stored data sorted by schema:

partitions
| summarize events=sum(events),
diskusage=sum(diskusage),
memusage=sum(memusage)
by schema
| sort schema

Get an upper bound for the number of events that could contain the IP address 127.0.0.1:

partitions :ip == 127.0.0.1
| summarize candidates=sum(events)

See how many partitions contain a non-null value for the field hostname:

partitions hostname != null